CVE-2026-22063 Details
Description
The private keys of eight eMudhra intermediate CA certificates have been compromised. eMudhra revoked the eight affected intermediate certificates on October 18, 2026. While this is not a software vulnerability, CVE-2026-22063 has been assigned to track relevant changes in impacted NetApp products.
A compromise of private keys from eight eMudhra intermediate CA certificates has been reported, leading to their revocation on October 18, 2026. Although this incident does not represent a software vulnerability, CVE-2026-22063 has been designated to monitor related impacts on NetApp products. In ONTAP 9, the 'AAA Certificate Services' root certificate was preinstalled in versions prior to 9.18.1, potentially allowing for Man-in-the-Middle attacks.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://security.netapp.com/advisory/NTAP-20261027-0001/ | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-327 | Use of a Broken or Risky Cryptographic Algorithm | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| NetApp ONTAP | < 9.18.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |